topic Re: Is there any log file maintained for UseAck activity? in Knowledge Management

Is there any log file maintained for UseAck activity?

Campbell04 — Thu, 14 Jun 2018 23:18:10 GMT

Our IT auditors are asking if there is a method/means to view the useACK activity for completeness.

Re: Is there any log file maintained for UseAck activity?

MuS — Fri, 15 Jun 2018 01:22:01 GMT

Hi Campbell04,

Yes, and No.
By default you will only get a message if the universal forwarder is sending events again.

BUT, one can increase the logging for any tcpout* channels which would give you the messages you are after, BUT (yes, another but) this will be a lot of additional events and therefore network traffic).

Hope this helps ...

cheers, MuS

Re: Is there any log file maintained for UseAck activity?

Campbell04 — Fri, 15 Jun 2018 02:42:12 GMT

Thanks. Where would you see these messages if the tcpout were increased? That is what I'm after.

Re: Is there any log file maintained for UseAck activity?

MuS — Sun, 17 Jun 2018 18:38:53 GMT

Hi Campbell04,

the universal forwarder will log a running number for each event in splunkd.log or index=_internal, but here are your next two problems : this running number has no direct link to the event (one might get this information by turning on more debug logging on all instances), and _internal will only be kept for 30 days be default.

cheers, MuS